CYB236 Chapter 8: Host-based Intrusion Detection Systems

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to Lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What is the primary function of a host-based IDPS?

  • To monitor the Internet for potential threats
  • To monitor the entire network for suspicious activity
  • To monitor the organization's firewall for unauthorized access
  • To monitor the characteristics of a single host and the events occurring within that host for suspicious activity (correct)

What is the typical component of most host-based IDPSs installed on the hosts of interest?

  • Proxies
  • Sensors
  • Agents (correct)
  • Gateways

What does an agent designed to monitor a server typically monitor?

  • The OS and common client applications
  • The OS and some common applications (correct)
  • Only the operating system (OS)
  • Only common applications

What is an application-based IDPS also known as?

<p>Some agents perform monitoring for a specific application service only (B)</p> Signup and view all the answers

Where do agents deploy to in a network architecture?

<p>To existing hosts on the organization's networks (C)</p> Signup and view all the answers

What do agents communicate over in a network architecture?

<p>Same networks (A)</p> Signup and view all the answers

What is the primary difference between a host-based IDPS and a network-based IDPS?

<p>The scope of monitoring (D)</p> Signup and view all the answers

What is the purpose of a prevention action in a host-based IDPS?

<p>To respond to suspicious activity (D)</p> Signup and view all the answers

What is the primary function of a shim in a host-based IDPS?

<p>To intercept, analyse, and determine allowing or denying access (C)</p> Signup and view all the answers

What type of architecture do host-based IDPSs use?

<p>Host-based (D)</p> Signup and view all the answers

What is logged by host-based IDPSs?

<p>Timestamp, event type, event details, and prevention action performed (B)</p> Signup and view all the answers

What is an example of an event detected by host-based IDPSs?

<p>All of the above (D)</p> Signup and view all the answers

What is a limitation of host-based IDPSs?

<p>All of the above (D)</p> Signup and view all the answers

What is a prevention capability of host-based IDPSs?

<p>Preventing code from being executed (B)</p> Signup and view all the answers

Where are appliance-based agents deployed?

<p>Inline, in front of the hosts they protect (C)</p> Signup and view all the answers

What is a security capability of host-based IDPSs?

<p>All of the above (D)</p> Signup and view all the answers

What is the primary purpose of Network Traffic Filtering?

<p>To prevent unauthorized access and acceptable use policy violations (C)</p> Signup and view all the answers

What is the function of Filesystem Monitoring?

<p>To prevent files from being accessed, modified, replaced, or deleted (B)</p> Signup and view all the answers

What is the purpose of Removable Media Restriction?

<p>To prevent malware from being transferred or copied to or from the host (D)</p> Signup and view all the answers

What does Audiovisual Device Monitoring indicate?

<p>If the host is compromised (D)</p> Signup and view all the answers

What is the function of Host Hardening?

<p>To detect and enable disabled security functions (B)</p> Signup and view all the answers

What is the purpose of Process Status Monitoring?

<p>To monitor the status of processes or services and security programs (A)</p> Signup and view all the answers

What is Network Traffic Sanitization used for?

<p>To prevent sensitive information from being displayed on web server pages (B)</p> Signup and view all the answers

What is unique about updating agents in host-based IDPSs?

<p>It is related to the type of operating system (C)</p> Signup and view all the answers

What is a common capability offered by most host-based IDPSs?

<p>Management capabilities (D)</p> Signup and view all the answers

Flashcards are hidden until you start studying

Related Documents

LEC 9.pptx

More Like This

Use Quizgecko on...
Browser
Open
Browser
Browser